Overview
- Description
- Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. This issue has been addressed in commit `ec117882d` which is expected to be included in subsequent releases. Users are advised to limit access to untrusted users until a new release is made.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:avohq:avo:*:*:*:*:*:ruby:*:*",
"vulnerable": true,
"matchCriteriaId": "27594A1A-CFFC-4741-9F4F-45532F8FFCFD",
"versionEndIncluding": "2.33.2"
},
{
"criteria": "cpe:2.3:a:avohq:avo:3.0.0:pre12:*:*:*:ruby:*:*",
"vulnerable": true,
"matchCriteriaId": "33F74798-D928-4FA3-B890-81C43DAC8F91"
}
],
"operator": "OR"
}
]
}
]